Base64 encoder / decoder
Encode text as Base64 or decode it back to text. Conversion runs in your browser using UTF-8.
Input is processed in your browser and is not sent to the server.
Decode auth headers and JWTs
Paste an Authorization: Basic header or a JWT. Only its parts are decoded; the signature is not verified.
Quick start
- Enter text on the left to encode.
- Enter Base64 on the right to decode.
- Choose URL-safe when your system requires it.
Formats
| Input or option | Result |
|---|---|
| hello | aGVsbG8= |
| Standard Base64 | Uses + and /, with optional trailing = padding. |
| URL-safe output | Uses - and _; this tool omits trailing = padding. |
Encoding is not encryption
Base64 represents bytes as text. It can be reversed without a key and should not be used to hide passwords or tokens. The encoded representation is usually larger than the source bytes.
If decoding fails
The input may be incomplete, contain invalid characters or padding, or represent binary data rather than UTF-8 text. Images and compressed files may not decode as readable text here.
The tool accepts standard and URL-safe input. Source text is limited to 200,000 characters and decoding input to 1,000,000. Processing stays in your browser.
Checking HTTP auth headers and JWTs
A Basic auth header is “user name:password” encoded in Base64. If requests keep getting 401, paste the header the client actually sent into the decoder above and check that the user name, special characters and line breaks are what you intended. Anyone can decode it, so sending it without HTTPS exposes the password.
A JWT is a header, payload and signature separated by dots; the first two parts are JSON encoded in Base64url. exp, nbf and iat are seconds counted from 1970-01-01 UTC. When a token is suddenly rejected, check first whether exp has passed, whether the server clock is earlier than nbf, and whether aud and iss match the server configuration. Only the server holding the key can verify the signature, so a decoded token is not proof that it is valid.
curl -sv -u admin:secret https://example.com/ -o /dev/null 2>&1 | grep -i '^> authorization'[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('admin:secret'))> Authorization: Basic YWRtaW46c2VjcmV0
YWRtaW46c2VjcmV0